咨询一个iptables多次取反排除网段的问题

[sdpdww]

/sbin/iptables -t mangle -A PREROUTING -s ！ 192.168.8.0/24 -j CONNMARK --set-mark 1',
/sbin/iptables -t mangle -A PREROUTING -s ！ 192.168.9.0/24 -j CONNMARK --set-mark 1',
看上面的两条语句，单独这任何一条，都能起到排除该网段的作用，但是我想排除两个网段，写了两条语句，就任何一个网段都排除不了了。
请问高手该怎么办？？

[啊呀]

不懂，这里有个贴对你有没有帮助 http://os.chinaunix.net/a2009/0429/993/000000993008.shtml

[小笨和漂向北方]

will this work? -s ! 192.168.8.0/24 -m iprange ! --src-range 192.168.9.1-192.168.9.254

[sdpdww]

引用 2 楼 micropentium6 的回复:

will this work? -s ! 192.168.8.0/24 -m iprange ! --src-range 192.168.9.1-192.168.9.254

这位兄台，如果我要排除更多的网段呢？比如192.168.8.x，192.168.9.x，192.168.2.x，192.138.1.x，要排除的网段还是很多的，肯定不能用range。

[小笨和漂向北方]

"这位兄台", please make your question clear up front next time ("但是我想排除两个网段") Try ipset, you may have to install it separately since some linux distributions don't carry it by default. ipset -N My_Hosts ipmap --network 192.0.0.0/8 Then you could use -m set --set My_Hosts in iptables rule. By doing so, you have combine multiple rules into one single rule. Does this work with inversion (!). I hope so. You could have a shot and let me know if it works...

[sdpdww]

引用 4 楼 micropentium6 的回复:

"这位兄台", please make your question clear up front next time ("但是我想排除两个网段") Try ipset, you may have to install it separately since some linux distributions don't carry it by default. ipset -N My_Hosts ipmap --network 192.0.0.0/8 Then you could use -m set --set My_Hosts in iptables rule. By doing so, you have combine multiple rules into one single rule. Does this work with inversion (!). I hope so. You could have a shot and let me know if it works...

兄台你的英文好风骚，ipset最好给出代码啊，我看网上ipset介绍的不是很多。